Groups the returned result by the field
id, makes a count on the events
and returns the minimum timestamp and maximum timestamp. This returns a
new event set, with the fields
id,
_count,
_min, and
_max.
logscale
|timeDiff:=_max-_min
Calculates the time difference between the maximum timestamp values and
the minimum timestamp values and returns the result in a new field named
timeDiff.
logscale
|timeDiff>300000and_count>10
Returns all events where the values of
timeDiff is greater that
300000 and where there are more
than 10 occurrences.
Event Result set.
Summary and Results
This query is used to set up alerts for parsers issues. Setting up
alerts for parsers issues will allow to proactively reach out to
customers where their queries are being throttled and help them.
